mirror of
https://github.com/RustPython/RustPython.git
synced 2026-10-28 10:44:36 +08:00
youknowdotandJeong, YunWon
06007c81fa
* Target Python 3.15 using the final upstream reference Update active version and comparison configuration to Python 3.15.0. Preserve the alpha implementation status, actual bytecode format, and existing libraries pending separate migration. Align generated library-upgrade workflow pins without changing permissions or actions. Assisted-by: OpenAI Codex:model identifier unavailable * Adapt essential snippet contracts to Python 3.15 final Preserve existing coverage while following verified final behavior for script metadata, builtin signatures and loading, AST fixture construction, memoryview diagnostics, mmap search bounds, and struct format errors. The unchanged final comparator exposes the earlier expectations; focused native baseline failures establish the required implementation changes. Assisted-by: OpenAI Codex:model identifier unavailable * Keep final-reference regression paths and remove expired sysconfig argument Preserve reverse multiplication syntax and native exact overflow diagnostics. Accept the two source-proven CPython 3.15 specialization messages only in affected reverse str/bytes/tuple cases. Use an actually out-of-range Windows datetime errno fixture. Remove the sysconfig check_home argument at its existing canonical 3.15 removal test boundary. Assisted-by: OpenAI Codex:model identifier unavailable * Keep README wording unchanged in Python 3.15 transition Assisted-by: OpenAI Codex:model identifier unavailable * Match Python 3.15 repetition specialization and keep universal tests Use exact sequence-type guards and preserve generic fallback diagnostics. Validate both cold and warmed expressions without implementation-specific assertions. Reject stale CPython source checkouts and cross-version library caches. Assisted-by: OpenAI Codex:model identifier unavailable * Limit in-place specialization additions to exact sequence repetition Assisted-by: OpenAI Codex:model identifier unavailable * Keep subclass regression scoped to repetition dispatch Assisted-by: OpenAI Codex:model identifier unavailable * Provision final CPython 3.15 with pinned uv builds Assisted-by: OpenAI Codex:model identifier unavailable * Enforce Python 3.15 AST constructor requirements Reject retired missing-field and arbitrary-keyword forms while preserving defaults and explicit placeholders. Sync only matching final CPython constructor test hunks. Assisted-by: OpenAI Codex:model identifier unavailable * Keep seeded Python ahead of its Windows DLL directory Assisted-by: OpenAI Codex:model identifier unavailable * Keep opcode metadata tied to the implemented bytecode format The interpreter target and reference tests use Python 3.15.0, but the current Rust opcode enum retains the 3.14 bytecode format. Generate metadata from its matching source rather than importing unsupported instruction families. Assisted-by: OpenAI Codex:model identifier unavailable * Align CSV, logarithm and decimal formatting with Python 3.15 Propagate dialect lookup errors except AttributeError, retry integer logarithms after float overflow, and update the decimal conversion diagnostic. Exercise the final reference contracts without implementation-specific branches. Assisted-by: OpenAI Codex:model identifier unavailable * Bind the logarithm index result before borrowing its integer Assisted-by: OpenAI Codex:model identifier unavailable * Align required canonical test expectations with Python 3.15 Take only demonstrated contract changes from CPython v3.15.0, d220409a13b77de7a6c30abe16ea90db01528edc: removed module __cached__, Struct format exception classes, and decimal-format diagnostic. Preserve unrelated tests and expectations. Assisted-by: OpenAI Codex:model identifier unavailable * Track pending frozendict pickle support during the 3.15 transition Keep the two existing frozendict pickle tests running as expected failures until #8951 supplies the builtin. Unexpected success will signal removal of these temporary markers. Assisted-by: OpenAI Codex:model identifier unavailable * Support final Python 3.15 Windows negative timestamps Use FILETIME for pre-epoch conversions and preserve precise Windows timestamp errors. Assisted-by: OpenAI Codex:model identifier unavailable * Derive historical Windows timezone offsets from wall time FILETIME reports historical DST as unknown, so calculate the actual offset rather than selecting standard-time bias. Assisted-by: OpenAI Codex:model identifier unavailable * Identify decimal formatting arguments in Python 3.15 errors Track consumed positional arguments, including star width and precision, and preserve mapping key representations in decimal conversion diagnostics. Assisted-by: OpenAI Codex:model identifier unavailable * Reuse mapping format keys for lookup and error context Assisted-by: OpenAI Codex:model identifier unavailable * Borrow mapping diagnostic keys as Python objects Assisted-by: OpenAI Codex:model identifier unavailable * Avoid empty components in the reference Python library path Assisted-by: OpenAI Codex:model identifier unavailable * Isolate RustPython bytecode caches during the 3.15 transition Assisted-by: OpenAI Codex:model identifier unavailable * Sync final Windows timestamp test expectations Import only the final CPython platform-limit guards and mktime roundtrip expectation required by the existing Windows CI suite. Assisted-by: OpenAI Codex:model identifier unavailable * Restore official Python setup for 3.15 final Use the existing pinned setup-python action now that its official catalog supplies CPython 3.15.0. Remove the temporary standalone provisioning action and its sparse-checkout entry while retaining interpreter outputs and requested versions. Assisted-by: OpenAI Codex:model identifier unavailable * Align merged runtime contracts with Python 3.15 final Restrict mappingproxy ordering, use final codec registry normalization, and prefer index conversion before float conversion for sleep. Retain universal Python assertions and import the matching final codec/time canonical test hunks plus the non-ASCII codec-name deprecation warning. Upstream source: CPython d220409a13b77de7a6c30abe16ea90db01528edc. The existing codec normalization implementation and bytecode contract remain unchanged. Assisted-by: OpenAI Codex:model identifier unavailable * Limit Windows launcher version check to its interpreter Exclude only the CPython py.exe version-identity case from RustPython CI. The installed launcher reports its own final version, while RustPython correctly remains alpha. Preserve the other 45 launcher cases and all RustPython version assertions without modifying Lib. Assisted-by: OpenAI Codex:model identifier unavailable --------- Co-authored-by: Jeong, YunWon <69878+youknowone@users.noreply.github.com>
1094 lines
54 KiB
YAML
Generated
1094 lines
54 KiB
YAML
Generated
#
|
|
# ___ _ _
|
|
# / _ \ | | (_)
|
|
# | |_| | __ _ ___ _ __ | |_ _ ___
|
|
# | _ |/ _` |/ _ \ '_ \| __| |/ __|
|
|
# | | | | (_| | __/ | | | |_| | (__
|
|
# \_| |_/\__, |\___|_| |_|\__|_|\___|
|
|
# __/ |
|
|
# _ _ |___/
|
|
# | | | | / _| |
|
|
# | | | | ___ _ __ _ __| |_| | _____ ____
|
|
# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
|
|
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
|
|
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
|
|
#
|
|
# This file was automatically generated by gh-aw (v0.43.22). DO NOT EDIT.
|
|
#
|
|
# To update this file, edit the corresponding .md file and run:
|
|
# gh aw compile
|
|
# Not all edits will cause changes to this file.
|
|
#
|
|
# For more information: https://github.github.com/gh-aw/introduction/overview/
|
|
#
|
|
# Pick an out-of-sync Python library from the todo list and upgrade it
|
|
# by running `scripts/update_lib quick`, then open a pull request.
|
|
#
|
|
# frontmatter-hash: bf5b6c1bf4e49141df567a8ff69cce1fc96faa991e1cc353ed6a77aa7c2ba719
|
|
|
|
name: "Upgrade Python Library"
|
|
"on":
|
|
workflow_dispatch:
|
|
inputs:
|
|
name:
|
|
description: Module name to upgrade (leave empty to auto-pick)
|
|
required: false
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: "gh-aw-${{ github.workflow }}"
|
|
|
|
run-name: "Upgrade Python Library"
|
|
|
|
env:
|
|
ISSUE_ID: "6839"
|
|
PYTHON_VERSION: v3.15.0
|
|
|
|
# Cache configuration from frontmatter was processed and added to the main job steps
|
|
|
|
jobs:
|
|
activation:
|
|
runs-on: ubuntu-slim
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
comment_id: ""
|
|
comment_repo: ""
|
|
steps:
|
|
- name: Setup Scripts
|
|
uses: github/gh-aw/actions/setup@c35393777e5604a63721d09512263b1383301d4f # v0.89.21
|
|
with:
|
|
destination: /opt/gh-aw/actions
|
|
- name: Check workflow file timestamps
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_WORKFLOW_FILE: "upgrade-pylib.lock.yml"
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
|
|
await main();
|
|
|
|
agent:
|
|
needs: activation
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
issues: read
|
|
pull-requests: read
|
|
concurrency:
|
|
group: "gh-aw-copilot-${{ github.workflow }}"
|
|
env:
|
|
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
GH_AW_ASSETS_ALLOWED_EXTS: ""
|
|
GH_AW_ASSETS_BRANCH: ""
|
|
GH_AW_ASSETS_MAX_SIZE_KB: 0
|
|
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
|
|
GH_AW_SAFE_OUTPUTS: /opt/gh-aw/safeoutputs/outputs.jsonl
|
|
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
|
|
GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
|
|
outputs:
|
|
checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
|
|
has_patch: ${{ steps.collect_output.outputs.has_patch }}
|
|
model: ${{ steps.generate_aw_info.outputs.model }}
|
|
output: ${{ steps.collect_output.outputs.output }}
|
|
output_types: ${{ steps.collect_output.outputs.output_types }}
|
|
secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
|
|
steps:
|
|
- name: Setup Scripts
|
|
uses: github/gh-aw/actions/setup@c35393777e5604a63721d09512263b1383301d4f # v0.89.21
|
|
with:
|
|
destination: /opt/gh-aw/actions
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Setup Python
|
|
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: '3.15'
|
|
- name: Create gh-aw temp directory
|
|
run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
|
|
# Cache configuration from frontmatter processed below
|
|
- name: Cache (cpython-lib-${{ env.PYTHON_VERSION }})
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
key: cpython-lib-${{ env.PYTHON_VERSION }}
|
|
path: cpython
|
|
- name: Configure Git credentials
|
|
env:
|
|
REPO_NAME: ${{ github.repository }}
|
|
SERVER_URL: ${{ github.server_url }}
|
|
run: |
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config --global user.name "github-actions[bot]"
|
|
# Re-authenticate git with GitHub token
|
|
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
|
|
git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
|
|
echo "Git configured with standard GitHub Actions identity"
|
|
- name: Checkout PR branch
|
|
id: checkout-pr
|
|
if: |
|
|
github.event.pull_request
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
|
|
await main();
|
|
- name: Generate agentic run info
|
|
id: generate_aw_info
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const fs = require('fs');
|
|
|
|
const awInfo = {
|
|
engine_id: "copilot",
|
|
engine_name: "GitHub Copilot CLI",
|
|
model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
|
|
version: "",
|
|
agent_version: "0.0.409",
|
|
cli_version: "v0.43.22",
|
|
workflow_name: "Upgrade Python Library",
|
|
experimental: false,
|
|
supports_tools_allowlist: true,
|
|
supports_http_transport: true,
|
|
run_id: context.runId,
|
|
run_number: context.runNumber,
|
|
run_attempt: process.env.GITHUB_RUN_ATTEMPT,
|
|
repository: context.repo.owner + '/' + context.repo.repo,
|
|
ref: context.ref,
|
|
sha: context.sha,
|
|
actor: context.actor,
|
|
event_name: context.eventName,
|
|
staged: false,
|
|
allowed_domains: ["defaults","rust","python"],
|
|
firewall_enabled: true,
|
|
awf_version: "v0.16.4",
|
|
awmg_version: "",
|
|
steps: {
|
|
firewall: "squid"
|
|
},
|
|
created_at: new Date().toISOString()
|
|
};
|
|
|
|
// Write to /tmp/gh-aw directory to avoid inclusion in PR
|
|
const tmpPath = '/tmp/gh-aw/aw_info.json';
|
|
fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2));
|
|
console.log('Generated aw_info.json at:', tmpPath);
|
|
console.log(JSON.stringify(awInfo, null, 2));
|
|
|
|
// Set model as output for reuse in other steps/jobs
|
|
core.setOutput('model', awInfo.model);
|
|
- name: Validate COPILOT_GITHUB_TOKEN secret
|
|
id: validate-secret
|
|
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
|
|
env:
|
|
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
|
|
- name: Install GitHub Copilot CLI
|
|
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.409
|
|
- name: Install awf binary
|
|
run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.16.4
|
|
- name: Determine automatic lockdown mode for GitHub MCP server
|
|
id: determine-automatic-lockdown
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
|
|
GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
|
|
with:
|
|
script: |
|
|
const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
|
|
await determineAutomaticLockdown(github, context, core);
|
|
- name: Download container images
|
|
run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.16.4 ghcr.io/github/gh-aw-firewall/squid:0.16.4 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
|
|
- name: Write Safe Outputs Config
|
|
run: |
|
|
mkdir -p /opt/gh-aw/safeoutputs
|
|
mkdir -p /tmp/gh-aw/safeoutputs
|
|
mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
|
|
cat > /opt/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_EOF'
|
|
{"create_pull_request":{"expires":30},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
|
|
GH_AW_SAFE_OUTPUTS_CONFIG_EOF
|
|
cat > /opt/gh-aw/safeoutputs/tools.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_EOF'
|
|
[
|
|
{
|
|
"description": "Create a new GitHub pull request to propose code changes. Use this after making file edits to submit them for review and merging. The PR will be created from the current branch with your committed changes. For code review comments on an existing PR, use create_pull_request_review_comment instead. CONSTRAINTS: Maximum 1 pull request(s) can be created. Title will be prefixed with \"Update \". Labels [pylib-sync] will be automatically added.",
|
|
"inputSchema": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"body": {
|
|
"description": "Detailed PR description in Markdown. Include what changes were made, why, testing notes, and any breaking changes. Do NOT repeat the title as a heading.",
|
|
"type": "string"
|
|
},
|
|
"branch": {
|
|
"description": "Source branch name containing the changes. If omitted, uses the current working branch.",
|
|
"type": "string"
|
|
},
|
|
"labels": {
|
|
"description": "Labels to categorize the PR (e.g., 'enhancement', 'bugfix'). Labels must exist in the repository.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"title": {
|
|
"description": "Concise PR title describing the changes. Follow repository conventions (e.g., conventional commits). The title appears as the main heading.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"title",
|
|
"body"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"name": "create_pull_request"
|
|
},
|
|
{
|
|
"description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
|
|
"inputSchema": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"alternatives": {
|
|
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
|
|
"type": "string"
|
|
},
|
|
"reason": {
|
|
"description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
|
|
"type": "string"
|
|
},
|
|
"tool": {
|
|
"description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"reason"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"name": "missing_tool"
|
|
},
|
|
{
|
|
"description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.",
|
|
"inputSchema": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"message": {
|
|
"description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"message"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"name": "noop"
|
|
},
|
|
{
|
|
"description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
|
|
"inputSchema": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"alternatives": {
|
|
"description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
|
|
"type": "string"
|
|
},
|
|
"context": {
|
|
"description": "Additional context about the missing data or where it should come from (max 256 characters).",
|
|
"type": "string"
|
|
},
|
|
"data_type": {
|
|
"description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
|
|
"type": "string"
|
|
},
|
|
"reason": {
|
|
"description": "Explanation of why this data is needed to complete the task (max 256 characters).",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [],
|
|
"type": "object"
|
|
},
|
|
"name": "missing_data"
|
|
}
|
|
]
|
|
GH_AW_SAFE_OUTPUTS_TOOLS_EOF
|
|
cat > /opt/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_EOF'
|
|
{
|
|
"create_pull_request": {
|
|
"defaultMax": 1,
|
|
"fields": {
|
|
"body": {
|
|
"required": true,
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 65000
|
|
},
|
|
"branch": {
|
|
"required": true,
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 256
|
|
},
|
|
"labels": {
|
|
"type": "array",
|
|
"itemType": "string",
|
|
"itemSanitize": true,
|
|
"itemMaxLength": 128
|
|
},
|
|
"title": {
|
|
"required": true,
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 128
|
|
}
|
|
}
|
|
},
|
|
"missing_tool": {
|
|
"defaultMax": 20,
|
|
"fields": {
|
|
"alternatives": {
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 512
|
|
},
|
|
"reason": {
|
|
"required": true,
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 256
|
|
},
|
|
"tool": {
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 128
|
|
}
|
|
}
|
|
},
|
|
"noop": {
|
|
"defaultMax": 1,
|
|
"fields": {
|
|
"message": {
|
|
"required": true,
|
|
"type": "string",
|
|
"sanitize": true,
|
|
"maxLength": 65000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
GH_AW_SAFE_OUTPUTS_VALIDATION_EOF
|
|
- name: Generate Safe Outputs MCP Server Config
|
|
id: safe-outputs-config
|
|
run: |
|
|
# Generate a secure random API key (360 bits of entropy, 40+ chars)
|
|
# Mask immediately to prevent timing vulnerabilities
|
|
API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
|
|
echo "::add-mask::${API_KEY}"
|
|
|
|
PORT=3001
|
|
|
|
# Set outputs for next steps
|
|
{
|
|
echo "safe_outputs_api_key=${API_KEY}"
|
|
echo "safe_outputs_port=${PORT}"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
echo "Safe Outputs MCP server will run on port ${PORT}"
|
|
|
|
- name: Start Safe Outputs MCP HTTP Server
|
|
id: safe-outputs-start
|
|
env:
|
|
DEBUG: '*'
|
|
GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
|
|
GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
|
|
GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
|
|
GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
|
|
GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
|
|
run: |
|
|
# Environment variables are set above to prevent template injection
|
|
export DEBUG
|
|
export GH_AW_SAFE_OUTPUTS_PORT
|
|
export GH_AW_SAFE_OUTPUTS_API_KEY
|
|
export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
|
|
export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
|
|
export GH_AW_MCP_LOG_DIR
|
|
|
|
bash /opt/gh-aw/actions/start_safe_outputs_server.sh
|
|
|
|
- name: Start MCP gateway
|
|
id: start-mcp-gateway
|
|
env:
|
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
|
|
GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
|
|
GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
|
|
GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -eo pipefail
|
|
mkdir -p /tmp/gh-aw/mcp-config
|
|
|
|
# Export gateway environment variables for MCP config and gateway script
|
|
export MCP_GATEWAY_PORT="80"
|
|
export MCP_GATEWAY_DOMAIN="host.docker.internal"
|
|
MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
|
|
echo "::add-mask::${MCP_GATEWAY_API_KEY}"
|
|
export MCP_GATEWAY_API_KEY
|
|
export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
|
|
mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
|
|
export DEBUG="*"
|
|
|
|
export GH_AW_ENGINE="copilot"
|
|
export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.4'
|
|
|
|
mkdir -p /home/runner/.copilot
|
|
cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
|
|
{
|
|
"mcpServers": {
|
|
"github": {
|
|
"type": "stdio",
|
|
"container": "ghcr.io/github/github-mcp-server:v0.30.3",
|
|
"env": {
|
|
"GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
|
|
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
|
|
"GITHUB_READ_ONLY": "1",
|
|
"GITHUB_TOOLSETS": "repos,issues,pull_requests"
|
|
}
|
|
},
|
|
"safeoutputs": {
|
|
"type": "http",
|
|
"url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
|
|
"headers": {
|
|
"Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
|
|
}
|
|
}
|
|
},
|
|
"gateway": {
|
|
"port": $MCP_GATEWAY_PORT,
|
|
"domain": "${MCP_GATEWAY_DOMAIN}",
|
|
"apiKey": "${MCP_GATEWAY_API_KEY}",
|
|
"payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
|
|
}
|
|
}
|
|
GH_AW_MCP_CONFIG_EOF
|
|
- name: Generate workflow overview
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
|
|
await generateWorkflowOverview(core);
|
|
- name: Create prompt with built-in context
|
|
env:
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
GH_AW_ENV_ISSUE_ID: ${{ env.ISSUE_ID }}
|
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
GH_AW_GITHUB_EVENT_INPUTS_NAME: ${{ github.event.inputs.name }}
|
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
run: |
|
|
bash /opt/gh-aw/actions/create_prompt_first.sh
|
|
cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
|
|
<system>
|
|
GH_AW_PROMPT_EOF
|
|
{
|
|
cat "/opt/gh-aw/prompts/xpia.md"
|
|
cat "/opt/gh-aw/prompts/temp_folder_prompt.md"
|
|
cat "/opt/gh-aw/prompts/markdown.md"
|
|
cat << 'GH_AW_PROMPT_EOF'
|
|
<safe-outputs>
|
|
<description>GitHub API Access Instructions</description>
|
|
<important>
|
|
The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
|
|
</important>
|
|
<instructions>
|
|
To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
|
|
|
|
Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
|
|
|
|
**IMPORTANT - temporary_id format rules:**
|
|
- If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
|
|
- If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
|
|
- Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
|
|
- Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
|
|
- INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
|
|
- VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
|
|
- To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
|
|
|
|
Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
|
|
|
|
Discover available tools from the safeoutputs MCP server.
|
|
|
|
**Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
|
|
|
|
**Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
|
|
</instructions>
|
|
</safe-outputs>
|
|
<github-context>
|
|
The following GitHub context information is available for this workflow:
|
|
{{#if __GH_AW_GITHUB_ACTOR__ }}
|
|
- **actor**: __GH_AW_GITHUB_ACTOR__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_REPOSITORY__ }}
|
|
- **repository**: __GH_AW_GITHUB_REPOSITORY__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_WORKSPACE__ }}
|
|
- **workspace**: __GH_AW_GITHUB_WORKSPACE__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
|
|
- **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
|
|
- **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
|
|
- **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
|
|
- **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
|
|
{{/if}}
|
|
{{#if __GH_AW_GITHUB_RUN_ID__ }}
|
|
- **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
|
|
{{/if}}
|
|
</github-context>
|
|
|
|
GH_AW_PROMPT_EOF
|
|
cat << 'GH_AW_PROMPT_EOF'
|
|
</system>
|
|
GH_AW_PROMPT_EOF
|
|
cat << 'GH_AW_PROMPT_EOF'
|
|
{{#runtime-import .github/workflows/upgrade-pylib.md}}
|
|
GH_AW_PROMPT_EOF
|
|
} >> "$GH_AW_PROMPT"
|
|
- name: Substitute placeholders
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
GH_AW_ENV_ISSUE_ID: ${{ env.ISSUE_ID }}
|
|
GH_AW_GITHUB_ACTOR: ${{ github.actor }}
|
|
GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
|
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
|
|
GH_AW_GITHUB_EVENT_INPUTS_NAME: ${{ github.event.inputs.name }}
|
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
|
|
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
|
|
GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
|
|
GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
with:
|
|
script: |
|
|
const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
|
|
|
|
// Call the substitution function
|
|
return await substitutePlaceholders({
|
|
file: process.env.GH_AW_PROMPT,
|
|
substitutions: {
|
|
GH_AW_ENV_ISSUE_ID: process.env.GH_AW_ENV_ISSUE_ID,
|
|
GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
|
|
GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
|
|
GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
|
|
GH_AW_GITHUB_EVENT_INPUTS_NAME: process.env.GH_AW_GITHUB_EVENT_INPUTS_NAME,
|
|
GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
|
|
GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
|
|
GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
|
|
GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
|
|
GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
|
|
}
|
|
});
|
|
- name: Interpolate variables and render templates
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
GH_AW_ENV_ISSUE_ID: ${{ env.ISSUE_ID }}
|
|
GH_AW_GITHUB_EVENT_INPUTS_NAME: ${{ github.event.inputs.name }}
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
|
|
await main();
|
|
- name: Validate prompt placeholders
|
|
env:
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
|
|
- name: Print prompt
|
|
env:
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
run: bash /opt/gh-aw/actions/print_prompt_summary.sh
|
|
- name: Clean git credentials
|
|
run: bash /opt/gh-aw/actions/clean_git_credentials.sh
|
|
- name: Execute GitHub Copilot CLI
|
|
id: agentic_execution
|
|
# Copilot CLI tool arguments (sorted):
|
|
timeout-minutes: 45
|
|
run: |
|
|
set -o pipefail
|
|
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,index.crates.io,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,sh.rustup.rs,static.crates.io,static.rust-lang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.16.4 --skip-pull \
|
|
-- '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' \
|
|
2>&1 | tee /tmp/gh-aw/agent-stdio.log
|
|
env:
|
|
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
|
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
|
|
GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
|
|
GH_AW_MODEL_AGENT_COPILOT: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
GITHUB_HEAD_REF: ${{ github.head_ref }}
|
|
GITHUB_REF_NAME: ${{ github.ref_name }}
|
|
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
|
|
GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
XDG_CONFIG_HOME: /home/runner
|
|
- name: Configure Git credentials
|
|
env:
|
|
REPO_NAME: ${{ github.repository }}
|
|
SERVER_URL: ${{ github.server_url }}
|
|
run: |
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config --global user.name "github-actions[bot]"
|
|
# Re-authenticate git with GitHub token
|
|
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
|
|
git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
|
|
echo "Git configured with standard GitHub Actions identity"
|
|
- name: Copy Copilot session state files to logs
|
|
if: always()
|
|
continue-on-error: true
|
|
run: |
|
|
# Copy Copilot session state files to logs folder for artifact collection
|
|
# This ensures they are in /tmp/gh-aw/ where secret redaction can scan them
|
|
SESSION_STATE_DIR="$HOME/.copilot/session-state"
|
|
LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
|
|
if [ -d "$SESSION_STATE_DIR" ]; then
|
|
echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR"
|
|
mkdir -p "$LOGS_DIR"
|
|
cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null || true
|
|
echo "Session state files copied successfully"
|
|
else
|
|
echo "No session-state directory found at $SESSION_STATE_DIR"
|
|
fi
|
|
- name: Stop MCP gateway
|
|
if: always()
|
|
continue-on-error: true
|
|
env:
|
|
MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
|
|
MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
|
|
GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
|
|
run: |
|
|
bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
|
|
- name: Redact secrets in logs
|
|
if: always()
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/redact_secrets.cjs');
|
|
await main();
|
|
env:
|
|
GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
|
|
SECRET_COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
|
|
SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
|
|
SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
|
|
SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Upload Safe Outputs
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: safe-output
|
|
path: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
if-no-files-found: warn
|
|
- name: Ingest agent output
|
|
id: collect_output
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
|
|
GH_AW_ALLOWED_DOMAINS: "*.pythonhosted.org,anaconda.org,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,github.com,host.docker.internal,index.crates.io,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,sh.rustup.rs,static.crates.io,static.rust-lang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
|
|
GITHUB_SERVER_URL: ${{ github.server_url }}
|
|
GITHUB_API_URL: ${{ github.api_url }}
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/collect_ndjson_output.cjs');
|
|
await main();
|
|
- name: Upload sanitized agent output
|
|
if: always() && env.GH_AW_AGENT_OUTPUT
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: agent-output
|
|
path: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
if-no-files-found: warn
|
|
- name: Upload engine output files
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: agent_outputs
|
|
path: |
|
|
/tmp/gh-aw/sandbox/agent/logs/
|
|
/tmp/gh-aw/redacted-urls.log
|
|
if-no-files-found: ignore
|
|
- name: Parse agent logs for step summary
|
|
if: always()
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
|
|
await main();
|
|
- name: Parse MCP gateway logs for step summary
|
|
if: always()
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
|
|
await main();
|
|
- name: Print firewall logs
|
|
if: always()
|
|
continue-on-error: true
|
|
env:
|
|
AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
|
|
run: |
|
|
# Fix permissions on firewall logs so they can be uploaded as artifacts
|
|
# AWF runs with sudo, creating files owned by root
|
|
sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
|
|
awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
|
|
- name: Upload agent artifacts
|
|
if: always()
|
|
continue-on-error: true
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: agent-artifacts
|
|
path: |
|
|
/tmp/gh-aw/aw-prompts/prompt.txt
|
|
/tmp/gh-aw/aw_info.json
|
|
/tmp/gh-aw/mcp-logs/
|
|
/tmp/gh-aw/sandbox/firewall/logs/
|
|
/tmp/gh-aw/agent-stdio.log
|
|
/tmp/gh-aw/agent/
|
|
/tmp/gh-aw/aw*.patch
|
|
if-no-files-found: ignore
|
|
|
|
conclusion:
|
|
needs:
|
|
- activation
|
|
- agent
|
|
- detection
|
|
- safe_outputs
|
|
if: (always()) && (needs.agent.result != 'skipped')
|
|
runs-on: ubuntu-slim
|
|
permissions:
|
|
contents: read
|
|
discussions: write
|
|
issues: write
|
|
pull-requests: write
|
|
outputs:
|
|
noop_message: ${{ steps.noop.outputs.noop_message }}
|
|
tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
|
|
total_count: ${{ steps.missing_tool.outputs.total_count }}
|
|
steps:
|
|
- name: Setup Scripts
|
|
uses: github/gh-aw/actions/setup@c35393777e5604a63721d09512263b1383301d4f # v0.89.21
|
|
with:
|
|
destination: /opt/gh-aw/actions
|
|
- name: Download agent output artifact
|
|
continue-on-error: true
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: agent-output
|
|
path: /tmp/gh-aw/safeoutputs/
|
|
- name: Setup agent output environment variable
|
|
run: |
|
|
mkdir -p /tmp/gh-aw/safeoutputs/
|
|
find "/tmp/gh-aw/safeoutputs/" -type f -print
|
|
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
|
|
- name: Process No-Op Messages
|
|
id: noop
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_NOOP_MAX: 1
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/noop.cjs');
|
|
await main();
|
|
- name: Record Missing Tool
|
|
id: missing_tool
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
|
|
await main();
|
|
- name: Handle Agent Failure
|
|
id: handle_agent_failure
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
|
|
GH_AW_WORKFLOW_ID: "upgrade-pylib"
|
|
GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
|
|
GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
|
|
await main();
|
|
- name: Handle No-Op Message
|
|
id: handle_noop_message
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
|
|
GH_AW_NOOP_MESSAGE: ${{ steps.noop.outputs.noop_message }}
|
|
GH_AW_NOOP_REPORT_AS_ISSUE: "true"
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/handle_noop_message.cjs');
|
|
await main();
|
|
- name: Handle Create Pull Request Error
|
|
id: handle_create_pr_error
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/handle_create_pr_error.cjs');
|
|
await main();
|
|
- name: Update reaction comment with completion status
|
|
id: conclusion
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
|
|
GH_AW_COMMENT_REPO: ${{ needs.activation.outputs.comment_repo }}
|
|
GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
|
|
GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }}
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs');
|
|
await main();
|
|
|
|
detection:
|
|
needs: agent
|
|
if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
|
|
runs-on: ubuntu-latest
|
|
permissions: {}
|
|
concurrency:
|
|
group: "gh-aw-copilot-${{ github.workflow }}"
|
|
timeout-minutes: 10
|
|
outputs:
|
|
success: ${{ steps.parse_results.outputs.success }}
|
|
steps:
|
|
- name: Setup Scripts
|
|
uses: github/gh-aw/actions/setup@c35393777e5604a63721d09512263b1383301d4f # v0.89.21
|
|
with:
|
|
destination: /opt/gh-aw/actions
|
|
- name: Download agent artifacts
|
|
continue-on-error: true
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: agent-artifacts
|
|
path: /tmp/gh-aw/threat-detection/
|
|
- name: Download agent output artifact
|
|
continue-on-error: true
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: agent-output
|
|
path: /tmp/gh-aw/threat-detection/
|
|
- name: Echo agent output types
|
|
env:
|
|
AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
|
|
run: |
|
|
echo "Agent output-types: $AGENT_OUTPUT_TYPES"
|
|
- name: Setup threat detection
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
WORKFLOW_NAME: "Upgrade Python Library"
|
|
WORKFLOW_DESCRIPTION: "Pick an out-of-sync Python library from the todo list and upgrade it\nby running `scripts/update_lib quick`, then open a pull request."
|
|
HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/setup_threat_detection.cjs');
|
|
await main();
|
|
- name: Ensure threat-detection directory and log
|
|
run: |
|
|
mkdir -p /tmp/gh-aw/threat-detection
|
|
touch /tmp/gh-aw/threat-detection/detection.log
|
|
- name: Validate COPILOT_GITHUB_TOKEN secret
|
|
id: validate-secret
|
|
run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
|
|
env:
|
|
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
|
|
- name: Install GitHub Copilot CLI
|
|
run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.409
|
|
- name: Execute GitHub Copilot CLI
|
|
id: agentic_execution
|
|
# Copilot CLI tool arguments (sorted):
|
|
# --allow-tool shell(cat)
|
|
# --allow-tool shell(grep)
|
|
# --allow-tool shell(head)
|
|
# --allow-tool shell(jq)
|
|
# --allow-tool shell(ls)
|
|
# --allow-tool shell(tail)
|
|
# --allow-tool shell(wc)
|
|
timeout-minutes: 20
|
|
run: |
|
|
set -o pipefail
|
|
COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"
|
|
mkdir -p /tmp/
|
|
mkdir -p /tmp/gh-aw/
|
|
mkdir -p /tmp/gh-aw/agent/
|
|
mkdir -p /tmp/gh-aw/sandbox/agent/logs/
|
|
copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"} 2>&1 | tee /tmp/gh-aw/threat-detection/detection.log
|
|
env:
|
|
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
|
|
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
|
|
GH_AW_MODEL_DETECTION_COPILOT: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }}
|
|
GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
|
|
GITHUB_HEAD_REF: ${{ github.head_ref }}
|
|
GITHUB_REF_NAME: ${{ github.ref_name }}
|
|
GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
|
|
GITHUB_WORKSPACE: ${{ github.workspace }}
|
|
XDG_CONFIG_HOME: /home/runner
|
|
- name: Parse threat detection results
|
|
id: parse_results
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
with:
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/parse_threat_detection_results.cjs');
|
|
await main();
|
|
- name: Upload threat detection log
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: threat-detection.log
|
|
path: /tmp/gh-aw/threat-detection/detection.log
|
|
if-no-files-found: ignore
|
|
|
|
safe_outputs:
|
|
needs:
|
|
- activation
|
|
- agent
|
|
- detection
|
|
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (needs.detection.outputs.success == 'true')
|
|
runs-on: ubuntu-slim
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: write
|
|
timeout-minutes: 15
|
|
env:
|
|
GH_AW_ENGINE_ID: "copilot"
|
|
GH_AW_WORKFLOW_ID: "upgrade-pylib"
|
|
GH_AW_WORKFLOW_NAME: "Upgrade Python Library"
|
|
outputs:
|
|
create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
|
|
create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
|
|
process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
|
|
process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
|
|
steps:
|
|
- name: Setup Scripts
|
|
uses: github/gh-aw/actions/setup@c35393777e5604a63721d09512263b1383301d4f # v0.89.21
|
|
with:
|
|
destination: /opt/gh-aw/actions
|
|
- name: Download agent output artifact
|
|
continue-on-error: true
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: agent-output
|
|
path: /tmp/gh-aw/safeoutputs/
|
|
- name: Setup agent output environment variable
|
|
run: |
|
|
mkdir -p /tmp/gh-aw/safeoutputs/
|
|
find "/tmp/gh-aw/safeoutputs/" -type f -print
|
|
echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
|
|
- name: Download patch artifact
|
|
continue-on-error: true
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: agent-artifacts
|
|
path: /tmp/gh-aw/
|
|
- name: Checkout repository
|
|
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request'))
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
token: ${{ github.token }}
|
|
persist-credentials: false
|
|
fetch-depth: 1
|
|
- name: Configure Git credentials
|
|
if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_pull_request'))
|
|
env:
|
|
REPO_NAME: ${{ github.repository }}
|
|
SERVER_URL: ${{ github.server_url }}
|
|
GIT_TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config --global user.name "github-actions[bot]"
|
|
# Re-authenticate git with GitHub token
|
|
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
|
|
git remote set-url origin "https://x-access-token:${GIT_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
|
|
echo "Git configured with standard GitHub Actions identity"
|
|
- name: Process Safe Outputs
|
|
id: process_safe_outputs
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
|
|
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"draft\":false,\"expires\":30,\"labels\":[\"pylib-sync\"],\"max\":1,\"max_patch_size\":1024,\"title_prefix\":\"Update \"},\"missing_data\":{},\"missing_tool\":{}}"
|
|
with:
|
|
github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
|
|
setupGlobals(core, github, context, exec, io);
|
|
const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs');
|
|
await main();
|
|
|